m3ta-chiron
0cc0b5064d
Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.
Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
mit明显 REPLACE-MARKER; build kann PEM parsen)
Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.
Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.
Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)
Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)
97 lines
2.6 KiB
Nix
97 lines
2.6 KiB
Nix
# roles/thin-client/apps/remmina.nix
|
|
#
|
|
# Remmina RDP client with system-wide connection profiles.
|
|
# Q10 decisions: System-wide /etc/remmina/, Kerberos SSO, several TS,
|
|
# Fullscreen+Multi-Monitor, only Audio local redirection.
|
|
#
|
|
# Note on "Several TS": we ship a small placeholder list with one example.
|
|
# Add real TS endpoints in az.tc.rdp.servers below.
|
|
{config, lib, pkgs, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
|
|
# Helper: builds a .remmina profile for one TS
|
|
mkRemminaProfile = server: let
|
|
name = server.name;
|
|
fqdn = server.fqdn;
|
|
in
|
|
pkgs.writeTextFile {
|
|
name = "${lib.toLower name}.remmina";
|
|
destination = "/etc/remmina/${lib.toLower name}.remmina";
|
|
text = ''
|
|
[remmina]
|
|
name=${name}
|
|
protocol=RDP
|
|
server=${fqdn}
|
|
username=
|
|
domain=AZ-GROUP
|
|
security=
|
|
colordepth=32
|
|
resolution=multimonitor
|
|
viewmode=2
|
|
fullscreen=1
|
|
multimon=1
|
|
audio-mode=1
|
|
audiocapture=0
|
|
clipboard=both
|
|
quality=2
|
|
kerberos=1
|
|
enable-authecol=kerberos
|
|
disableclipboard=0
|
|
redirectsound=1
|
|
redirectprinter=0
|
|
redirectdrive=0
|
|
redirectusb=0
|
|
keyboard-grab=1
|
|
showcursor=1
|
|
'';
|
|
};
|
|
in {
|
|
options.az.tc.rdp = {
|
|
servers = mkOption {
|
|
type = types.listOf (types.submodule {
|
|
options = {
|
|
name = mkOption {
|
|
type = types.str;
|
|
description = "Display name (e.g. 'TS Berlin', 'TS ERP').";
|
|
};
|
|
fqdn = mkOption {
|
|
type = types.str;
|
|
description = "FQDN of the TS endpoint (e.g. 'ts-berlin.az-group.local').";
|
|
};
|
|
};
|
|
});
|
|
default = [
|
|
# TODO: fill real TS endpoints
|
|
{
|
|
name = "TS Berlin";
|
|
fqdn = "ts-berlin.az-group.local";
|
|
}
|
|
];
|
|
description = ''
|
|
List of Terminal Server endpoints. One Remmina profile per entry
|
|
is generated system-wide.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = with pkgs; [
|
|
remmina
|
|
freerdp
|
|
];
|
|
|
|
# System-wide Remmina profiles
|
|
environment.etc = builtins.listToAttrs (builtins.map (server: {
|
|
name = "remmina/${lib.toLower server.name}.remmina";
|
|
value.source = (mkRemminaProfile server) + "/etc/remmina/${lib.toLower server.name}.remmina";
|
|
})
|
|
config.az.tc.rdp.servers);
|
|
|
|
# Allow Domain Users to read the system-wide profiles
|
|
systemd.tmpfiles.rules = [
|
|
"d /etc/remmina 0755 root root -"
|
|
];
|
|
};
|
|
}
|